Saxo Bank Securities: an attack on the server of an outsourced deposit tool leaked data of 38,000 customers, with 378 My Numbers

1. 2020-07-14 06:00

   Around this time, the server of a deposit and withdrawal tool built by an outside vendor was accessed without permission. [1] [4]

2. 2020-07-14 22:30

   Staff noticed something was wrong. [4]

3. 2020-07-15 04:40

   The server was shut down and cut off from outside access. [1] [4]

4. 2020-07-16 17:45

   Public disclosure. [1] [3]

5. 2020-07-31

   Two-step login verification by SMS was introduced. [2]

6. 2020-09-17 13:00

   The company published its investigation results and settled the number of people affected. [2]

7. 2020-09-18

   The Financial Services Agency issued a business improvement order, demanding tighter data management and clear management responsibility. [5]

8. 2021-02-17

   The Japan Securities Dealers Association reprimanded the firm, saying it had not taken sufficient measures against a recurrence on system risks and the management of contractors, and recommended building an internal control system. [6]

Names, addresses, birth dates, contact details, bank account details and other data of 38,026 customers leaked. For 750 of them, images of ID documents such as driver's licenses, health insurance cards, passports, residence certificates and My Number cards also leaked, and 378 My Numbers were included. [1] [2] [5]

Passwords for the trading platforms and trading account data are kept on servers of the parent Saxo Bank and did not leak. [1]

The reprimand dated February 17, 2021 recommended that the firm build an internal control system that ensures proper operation on system risks and contractor management so it can meet its duties to keep personal data safe and supervise contractors. It also asked the firm to handle customer inquiries and prevent further harm, and to report in writing on the measures against recurrence and their verification. The Kanto Local Finance Bureau had issued a business improvement order in September. [6]